Event messages produced by the devices in a computer system, such as a computer center or server system, are used to monitor and manage computer systems and networks. In addition to reporting the health of network devices, hosts and servers, event messages also report on activities, such as network traffic, observed by the devices in a computer system. Event messages can be correlated to detect system conditions and/or predict problems.
Typically, processing the event messages produced by the devices in a computer system requires programs customized to process each type of event, or each distinct group of events, produced by any of the system's devices. Customized programs (which generally must be compiled to generate executable code) are inefficient because they require frequent maintenance or revision to keep the programs compatible with new devices and updates to existing devices in the system. Using customized scripts instead of customized programs is impractical because scripts are typically slow to execute, as they are interpreted in real time, and therefore unlikely to be able to process event messages at the high rates that such messages are produced by the devices in large scale commercial computer systems.